Live data from Hacker News

I discovered a browser bug

jakearchibald.com

81–90 of 137 posts

Re: I discovered a browser bug

#81

I can echo his experience reporting browser bugs and provide my own reviews: Firefox - By far the best. Quick response, usually from engineers. If it's important the fix will be quick. Edge - No reply for months / years. When I've gotten replies back it's been to ask me to try with the current version. When I do and the bug still exists it goes back at the bottom of the queue it seems. Chrome - Somewhat of a mixed ba…

[deleted]

Re: I discovered a browser bug

#82
post #55

Earlier quoted context omitted.

No. The burden needs to be on the user to understand their own security. If we stopped taking the burden out of user's hands and tried to ensure that everyone on the Internet understood that anything they access becomes data on their computer/device, we'd have a smarter Internet. Frankly, I think if we made people understand that they have a responsibility to choose what they download, there might be more vocal group…

> The moment a browser alone begins controlling what the user sees, or does not see, without the user having the ability to control it, we have a major problem. What you're describing would be inordinately taxing for even the most experienced developer, not to mention the average internet user. The only way this could possibly be viable would be if we used gopher:// instead of http(s):// Currently, there are tools su…

>The prerequisites for using [Privoxy & Greasemonkey] range from full-blown programming skill...

Neither Privoxy nor GreaseMonkey require actual programming knowledge. I do not program, and I use Greasemonkey with some regularity - I use a combination of userscripts.org scripts and my own. They require a basic knowledge of specific scripting language implementations. Besides, Greasemonkey & uBlock/uMatrix both have a right-click menu entry that amounts to "hide anything like this".

You're saying that 99% of the Internet's users can't handle being required to interact with the most basic front-end technologies which power the network they use every day, and which they willingly give up their private information to - thus having no ability to provide evidence for their trust or any expectation of their privacy. Frankly speaking, my mindset is that if it's not viable for them to understand it, it shouldn't be viable for them to use it. Uneducated users lead to nothing but trouble; and sure, I'll grant that I'm suggesting educating them the hard way, but I think the Web as a whole would be better off in the long run from smarter users and dumber clients. Heck, I think the whole world would be better off with smarter users and dumber clients/terminals/systems.

Also, please, don't even begin to suggest that uneducated users should be directed to Gopher holes. You know as well as I do that if there's enough people going back to it, some yutz is gonna start trying to figure out how to add streaming this and scripted that to Gopher, and then Gopherspace will be ruined. And sure, on a technical level it would be a neat project to look at. But to reference Jurassic Park, a lot of very smart people have been so amazed at what they could do with the Web and the Internet as a whole, that they never really stopped to ask if they should do it.

Re: I discovered a browser bug

#83
I'm not familiar with the Web Audio APIs, was the Edge bug effectively interpreting the stream of bytes from the cross origin request as an 'audio stream', and then the OP just wrote a thing to convert it back so it could be converted into a string?

Re: I discovered a browser bug

#84

I'm not familiar with the Web Audio APIs, was the Edge bug effectively interpreting the stream of bytes from the cross origin request as an 'audio stream', and then the OP just wrote a thing to convert it back so it could be converted into a string?

A stream of bytes is valid PCM (that's the point). The issue is that Edge would first allow a redirect to a cross-origin then would leak the entirety of the cross-origin data by allowing it through the Web Audio API — an API for low-level audio processing and synthesizing — ultimately allowing the attacker to retrieve the cross-origin resource.

Re: I discovered a browser bug

#85

Earlier quoted context omitted.

Yeah that Chrome experience doesn't sound great. Fwiw I tend to put my test cases on jsbin or Glitch, but yeah, a Chrome engineer should know to put the page on a basic web server. If anyone runs into problems like this, feel free to bug one of the Chrome dev rel folks, such as me.

> If anyone runs into problems like this, feel free to bug one of the Chrome dev rel folks, such as me. Hi, and thanks for being part of creating Chrome && reaching out here. Now that I have a Chrome guy here maybe you can help with another annoying issues: -QC internally at Google seems to be blissfully unaware of the fact that other browsers exists. Examples: - one glaring issue I'm running into in core Angular on…

none of those are something a chrome dev rel person can help you with.

People like you are the reason we have to deal with three layers of low-level tech support before we can actually talk to somebody who knows what they're doing - please don't just spray your random complaints at anybody who happens to be related to google in any way.

Re: I discovered a browser bug

#86

Earlier quoted context omitted.

> If anyone runs into problems like this, feel free to bug one of the Chrome dev rel folks, such as me. Hi, and thanks for being part of creating Chrome && reaching out here. Now that I have a Chrome guy here maybe you can help with another annoying issues: -QC internally at Google seems to be blissfully unaware of the fact that other browsers exists. Examples: - one glaring issue I'm running into in core Angular on…

none of those are something a chrome dev rel person can help you with. People like you are the reason we have to deal with three layers of low-level tech support before we can actually talk to somebody who knows what they're doing - please don't just spray your random complaints at anybody who happens to be related to google in any way.

And it's not like the Chrome dev rel team doesn't fight for these things, but ultimately the Chrome team doesn't have any control of prioritisation of bugs in other products (like Calendar).

The only way we're going to see a significant change is when those high up in the Google org chart start caring about products working well in other browsers; as long as it's up to each individual product we'll continue to see products prioritising time-to-market and targeting only the browser with the majority of the market.

Re: I discovered a browser bug

#87

Earlier quoted context omitted.

Yeah, that's not great, but the commenter in #12 is a senior engineer on devtools, so at least the right person saw it in the end.

https://bugs.chromium.org/p/chromium/issues/detail?id=674096... was an assignment 6 months ago. It's still open after 2.5 years. I would not call this a good outcome.

What would you rather happen? Browser vendors hire more people such that they can fix every valid bug ever filed?

Re: I discovered a browser bug

#88

I can echo his experience reporting browser bugs and provide my own reviews: Firefox - By far the best. Quick response, usually from engineers. If it's important the fix will be quick. Edge - No reply for months / years. When I've gotten replies back it's been to ask me to try with the current version. When I do and the bug still exists it goes back at the bottom of the queue it seems. Chrome - Somewhat of a mixed ba…

Personally over many bug reports and many years:

A+ experience with the Chrome team

E with Edge

F with Safari

The Chrome devs have been astonishingly good. My experience has repeatably been that if they are given a good bug report, they get it fixed and often fix it really fast. Or they reply with excellent technical reasons why not. Also multiple times I have seen extreme corner-case regressions get magically fixed without me reporting anything!

Edge - always waffle and misdirection in reply to bug reports. I only bother to give them very well documented, repeatable bugs, plus attached repro file, for things I really need fixed. However: I did have one good experience recently because I reported the bug for the Edge beta, on a feature they were actively working on catching up to the other browsers (however they still had poor interaction).

Safari: hopeless. Report a critical bug with excellent repro file, and get no response, and no fix.

No rating for Firefox because I haven't bothered reported any bugs to them in the last few years.

Edit: this is for non-security related bugs.

Re: I discovered a browser bug

#89

Earlier quoted context omitted.

> If anyone runs into problems like this, feel free to bug one of the Chrome dev rel folks, such as me. Hi, and thanks for being part of creating Chrome && reaching out here. Now that I have a Chrome guy here maybe you can help with another annoying issues: -QC internally at Google seems to be blissfully unaware of the fact that other browsers exists. Examples: - one glaring issue I'm running into in core Angular on…

none of those are something a chrome dev rel person can help you with. People like you are the reason we have to deal with three layers of low-level tech support before we can actually talk to somebody who knows what they're doing - please don't just spray your random complaints at anybody who happens to be related to google in any way.

> none of those are something a chrome dev rel person can help you with.

Chrome dev rel persons are Google employees. I've been surprised by how much can be fixed once somebody on the inside are aware of it.

Also it seems a lit of googlers hang around here so it might get picked up based on that too.

> People like you are the reason we have to deal with three layers of low-level tech support before we can actually talk to somebody who knows what they're doing -

Blame Google, not me. Where there is a bug tracker I often use it.

Unfortunately there isn't a public one for Search, Calendar etc.

When they choose to only engage on HN, and only with one guy from dev rel, that's where I'll post.

Re: I discovered a browser bug

#90

Earlier quoted context omitted.

none of those are something a chrome dev rel person can help you with. People like you are the reason we have to deal with three layers of low-level tech support before we can actually talk to somebody who knows what they're doing - please don't just spray your random complaints at anybody who happens to be related to google in any way.

> none of those are something a chrome dev rel person can help you with. Chrome dev rel persons are Google employees. I've been surprised by how much can be fixed once somebody on the inside are aware of it. Also it seems a lit of googlers hang around here so it might get picked up based on that too. > People like you are the reason we have to deal with three layers of low-level tech support before we can actually ta…

well thanks for doing your best to ensure they stop engaging on HN, i guess...
Post reply on HN